Migration, consolidation, virtualization, data center relocation, and cloudification are examples of large-scale coordinated changes to an organization's IT infrastructure. These changes may pertain to servers, services, or applications. As used herein, those as well as similar tasks are collectively referred to as “IT transformation.” Also, the original IT infrastructure is referred to as the source infrastructure or source environment, and the new IT infrastructure (which in some cases may include part of the source environment) is referred to as the target infrastructure or target environment. The source and target IT infrastructures may be physical or virtual, may include the same or different server/device platforms, and may be located in a traditional data center, server rack, or even the cloud. During many such activities, a common requirement is that components that were able to communicate in the source environment should also be able to do so in the target environment. For example, it may be required that a set of clients that were previously able to communicate with a server in the source environment should also be able to do the same with the migrated server in the target environment.
Accordingly, in IT transformation activities, the network device infrastructure (which includes routers, firewalls, switches, etc.) may need to be configured such that communication patterns (plus or minus some patterns) in the source environment are represented in the target environment. In existing approaches, firewall configuration in the target environment is performed by migration architects in a complex, manual, and error-prone fashion, often resulting in missed deadlines, incorrect networking setups, and application failures. The following factors can contribute to the complexity and error-prone nature of this exercise:                Some transformation activities may also involve optimization of security and communications. In such scenarios, some communications that were allowed in the source environment may be identified as security holes that need to be plugged or are no longer necessary in the target environment. Likewise, new applications may be introduced in the target environment, and as a result, new communications that were not prevalent in the source environment may need to be introduced in the target environment.        Often in IT transformation, the network topology in the target environment may differ (partially or completely) from that in the source environment.        The network devices in the target environment may be from a different vendor or different versions/models from the same vendor.        The transformation activities may be applied to a subset of the devices, servers, services, and/or applications in the source environment or to the entire environment.        
A need therefore exists to provide migration architects with an automated and intelligent capability for analyzing, designing, and configuring firewalls as part of IT transformation activities.